X509CertificateNSS::Verify should honor the VERIFY_REV_CHECKING_ENABLED...

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/pickle.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ skipping 658 matching lines @@
           reinterpret_cast<const char*>(paypal_null_der),
           sizeof(paypal_null_der));
 
   ASSERT_NE(static_cast<X509Certificate*>(NULL), paypal_null_cert);
 
   const X509Certificate::Fingerprint& fingerprint =
       paypal_null_cert->fingerprint();
   for (size_t i = 0; i < 20; ++i)
     EXPECT_EQ(paypal_null_fingerprint[i], fingerprint.data[i]);
 
-#if defined(OS_WIN)
-  // TODO(wtc): The Linux try bots still have NSS 3.12.0.  They need to be
-  // updated to NSS 3.12.3.1 or later.  Also, nss_ocsp.cc asserts that the
-  // current thread is a worker thread in our thread pool and therefore has
-  // no message loop.  That assertion is overly strict.
   int flags = 0;
   CertVerifyResult verify_result;
   int error = paypal_null_cert->Verify("www.paypal.com", flags,
                                        &verify_result);
   EXPECT_NE(OK, error);
   // Either the system crypto library should correctly report a certificate
   // name mismatch, or our certificate blacklist should cause us to report an
   // invalid certificate.
+#if defined(OS_WIN)
+  // TODO(wtc): The Linux try bots still have NSS 3.12.0.  They need to be
+  // updated to NSS 3.12.3.1 or later.
   EXPECT_NE(0, verify_result.cert_status &
             (CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_INVALID));
 #endif
 }
 
 // Tests X509Certificate::Cache via X509Certificate::CreateFromHandle.  We
 // call X509Certificate::CreateFromHandle several times and observe whether
 // it returns a cached or new X509Certificate object.
 //
 // All the OS certificate handles in this test are actually from the same
@@ skipping 88 matching lines @@
 
   policy.Allow(webkit_cert.get());
 
   EXPECT_EQ(policy.Check(google_cert.get()), X509Certificate::Policy::DENIED);
   EXPECT_EQ(policy.Check(webkit_cert.get()), X509Certificate::Policy::ALLOWED);
   EXPECT_TRUE(policy.HasAllowedCert());
   EXPECT_TRUE(policy.HasDeniedCert());
 }
 
 }  // namespace net